Issue on CIS 1.2.1 about amazon2023-cis HOT 5 CLOSED

HI @ssarkar9

Thank you for taking the time to raise this issue, apologies for the time taking to respond, subscribers and other projects take priority im afraid.
Reading through the thread it appears;

1/ the gpg key details as found in vars/main.yml are no longer correct - these will need to be updated

The second thread appears to be more around 1.2.4 and gpg check for a repo.
2/ the repo_gpgcheck is indeed listed as known error, many repositories do not allow repo_gpg but only the package gpg themselves.. This is a case of understanding your systems and capabilities as some, do, some did and some just dont support this ( This is across all the repos we maintain).

Will look to raise item one as the actual issue. Please let me know if my understanding of your issue is correct.

many thanks

uk-bolly

from amazon2023-cis.

amazonlinux/amazon-linux-2023#336

from amazon2023-cis.

Maybe this is more of a clarity of text issue than an issue with item 1.2.1 ?

To quote the CIS Amazon Linux 2023 Benchmark v1.0:

Take care to set this value to false (default) for particular repositories that do not support it.

Currently, that includes the AL2023 repositories that do not support it. Since the CIS Benchmark for AL2023 does take care to indicate that it should only be set for repositories that support it, it doesn't conflict with 1.2.1 to not have repository metadata signed.

from amazon2023-cis.

When I am running galaxy roles of amazon-cis benchmark for amazon linux 2023 ,I had this error
Do we have a solution or workaround for this ?

Using packer to build and ansible to configure

amazon-ebs.amazon_ami: TASK [AMAZON2023-CIS : 1.2.1 | AUDIT | Ensure GPG keys are configured | list installed pubkey keys] ***
amazon-ebs.amazon_ami: ok: [default]
amazon-ebs.amazon_ami:
amazon-ebs.amazon_ami: TASK [AMAZON2023-CIS : 1.2.1 | AUDIT | Ensure GPG keys are configured | Query found keys] ***
amazon-ebs.amazon_ami: skipping: [default]
amazon-ebs.amazon_ami:
amazon-ebs.amazon_ami: TASK [AMAZON2023-CIS : 1.2.1 | AUDIT | Ensure GPG keys are configured | expected keys fail] ***
amazon-ebs.amazon_ami: fatal: [default]: FAILED! => {"changed": false, "msg": "Installed GPG Keys do not meet expected values or expected keys are not installed"}
amazon-ebs.amazon_ami:
amazon-ebs.amazon_ami: PLAY RECAP *********************************************************************
amazon-ebs.amazon_ami: default : ok=96 changed=34 unreachable=0 failed=1 skipped=22 rescued=0 ignored=0
amazon-ebs.amazon_ami:

from amazon2023-cis.

When I am running galaxy roles of amazon-cis benchmark for amazon linux 2023 ,I had this error Do we have a solution or workaround for this ?

Using packer to build and ansible to configure

amazon-ebs.amazon_ami: TASK [AMAZON2023-CIS : 1.2.1 | AUDIT | Ensure GPG keys are configured | list installed pubkey keys] *** amazon-ebs.amazon_ami: ok: [default] amazon-ebs.amazon_ami: amazon-ebs.amazon_ami: TASK [AMAZON2023-CIS : 1.2.1 | AUDIT | Ensure GPG keys are configured | Query found keys] *** amazon-ebs.amazon_ami: skipping: [default] amazon-ebs.amazon_ami: amazon-ebs.amazon_ami: TASK [AMAZON2023-CIS : 1.2.1 | AUDIT | Ensure GPG keys are configured | expected keys fail] *** amazon-ebs.amazon_ami: fatal: [default]: FAILED! => {"changed": false, "msg": "Installed GPG Keys do not meet expected values or expected keys are not installed"} amazon-ebs.amazon_ami: amazon-ebs.amazon_ami: PLAY RECAP ********************************************************************* amazon-ebs.amazon_ami: default : ok=96 changed=34 unreachable=0 failed=1 skipped=22 rescued=0 ignored=0 amazon-ebs.amazon_ami:

Hi @ntndash @ssarkar9

I'm struggling to reproduce the error with 1.2.1 from the devel branch.
I have just updated the image to the latest and run again and still no issues seen.

here is the manual output.
I confirmed the gpg key in the first command matches the variable defined in vars/main.yml

ec2-user@az2023_host rpm-gpg]$ rpm -q gpg-pubkey
gpg-pubkey-d832c631-63977702
[ec2-user@az2023_host rpm-gpg]$ rpm -q --queryformat "%{PACKAGER} %{VERSION}\\n" gpg-pubkey-d832c631-63977702
Amazon Linux <[email protected]> d832c631
[ec2-user@az2023_host rpm-gpg]$ rpm -q --queryformat "%{PACKAGER} %{VERSION}\\n" gpg-pubkey-d832c631-63977702 | grep "Amazon Linux <[email protected]> d832c631"
Amazon Linux <[email protected]> d832c631
[ec2-user@az2023_host rpm-gpg]$ echo $?
0

Many thanks

uk-bolly

p.s. To highlight i am putting testing the devel branch, i will be pushing out a new release soon.

from amazon2023-cis.